Skip to content

Commit 45aea66

Browse files
agilgur5agilgur5
authored
env/deps: remove greenkeeper.json, configure dependabot.yml (#846)
- Greenkeeper has shut down, Snyk has been incredibly annoying and can't be configured in the codebase (installed by Jared and could only be configured by Jared), so use native Dependabot now - GitHub acquired Dependabot a little over a year ago and it is what powers GitHub vulnerability updates - set-up sensible defaults with YAML anchor/alias - to only make PRs weekly, not spam daily - to only make PRs for deps, not devDeps - to only increase version when necessary, not for every patch and minor bump when a dep isn't pinned anyway - to use "deps:" prefix similarly to what I use - set-up Dependabot to ignore /website entirely, for dep upgrades and vulnerabilities, as it is not a published package and doesn't really have an attack surface area - should only be updated as needed, not whenever a dep is upgraded - temporarily ignore "/" as well because it's currently being updated so don't want duplication spam - but leave security PRs on, only dep upgrades off
1 parent 826cd07 commit 45aea66

2 files changed

Lines changed: 33 additions & 10 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
version: 2
2+
3+
# default configuration
4+
defaults: &defaults
5+
package-ecosystem: npm
6+
directory: '/'
7+
schedule:
8+
interval: weekly # don't spam daily
9+
# only increase version when required, don't bump every patch or minor
10+
versioning-strategy: increase-if-necessary
11+
allow:
12+
# only upgrade prod deps (not devDeps)
13+
- dependency-name: '*'
14+
dependency-type: production
15+
commit-message:
16+
prefix: 'deps:' # prefix commit with deps: for consistency
17+
18+
updates:
19+
# configuration for /
20+
- <<: *defaults
21+
# temporarily disable dep upgrade PRs for / as they're being updated
22+
open-pull-requests-limit: 0
23+
24+
# configuration for /website
25+
- <<: *defaults
26+
directory: /website
27+
# /website is not a published package and doesn't really have an attack
28+
# surface area, should only be updated as needed, not as soon as deps change
29+
ignore:
30+
# no security PRs for /website
31+
- dependency-name: '*'
32+
# disable dep upgrade PRs for /website
33+
open-pull-requests-limit: 0

‎greenkeeper.json‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

0 commit comments

Comments
 (0)